2026-10-14 · 6 min read · Rahul Chitturi
- cookies
- privacy
- http
A Partitioned cookie is stored under a key that includes the top-level site, not only the host that set it. Cookies Having Independent Partitioned State (CHIPS) is how an embedded site can keep a cookie in one embedder without handing that same cookie to every other site that frames it.
The symptom is usually that the cookie exists on one customer domain and is missing on another. That split is the feature. Treating it as a lost cookie and removing Partitioned restores the cross-site leak the attribute was added to stop.
Read the attributes as a set
A cross-site iframe cookie that should be partitioned is typically Set-Cookie with Secure, SameSite=None, and Partitioned. Partitioned without Secure is rejected. SameSite=Lax or Strict will not be sent on the cross-site iframe request even if Partitioned is present.
The partition key is the schemeful top-level site: https://customer.example and http://customer.example are different, and customer.example and other.example are different. The iframe's own host is not the partition key.
- Record the top-level URL, not only the iframe URL.
- Record Secure, SameSite, Domain, Path, and Partitioned together.
- Do not log the cookie value.
- Check a second top-level site before you delete the attribute.
Separate first-party cookies from embed cookies
A cookie for your own site, set while your site is the top-level document, does not need Partitioned to be sent on later same-site navigations. Adding Partitioned there can make the cookie disappear when the browser keys it to an unexpected top-level site during an OAuth redirect or a preview hostname.
A cookie jar cleared as third-party data can drop a partition and leave the first-party cookies in place. The application then looks logged out only inside the embed. Compare the two jars before you rotate secrets.
Write the partition key next to the header
In the ticket, write the top-level site, the iframe host, and the Set-Cookie attribute list with the value redacted. Diff that list between the working embedder and the failing one. A missing Secure flag on one environment is a different bug from a different top-level site.
Use Flashman's URL tool on the top-level site and the iframe URL, the JSON formatter for a redacted cookie record, diff on the two attribute lists, and the regex tester to find Partitioned and SameSite in a captured header.